UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF WISCONSIN 


Case No. 17-CR-124-2-JPS 

ORDER 


1. INTRODUCTION 

Defendant Marcus Hutchins is a hacker who received considerable 
attention for disabling a North Korean malware called WannaCry. He has 
a reputation as a "white hat" hacker, which implies a hacker who works for 
the benefit of the public. Hutchins has nevertheless been indicted for 
various crimes related to his activity with two forms of malware, "Kronos" 
and "UPAS Kit." 

On March 30, 2018, Hutchins filed a motion to suppress the 
statement that he made to Federal Bureau of Investigation ("FBI") agents 
immediately following his arrest, as well as any evidence the government 
may have obtained as a result. (Docket #55). On July 13,2018, Hutchins also 
filed three motions to dismiss various counts in the superseding indictment. 
(Docket #92, #95, and #96).^ Magistrate Judge Nancy Joseph issued a report 
and recommendation in which she recommended denying all motions. 


UNITED STATES OF AMERICA, 

Plaintiff, 

V. 

MARCUS HUTCHINS, 

Defendant. 


^Hutchins's motion to dismiss for failure to state offenses and multiplicity 
(Docket #95) relates to the superseding indictment and is intended to replace his 
original motion to dismiss (Docket #56), which will be denied as moot. 
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(Docket #109). Hutchins timely objected, and each party has fully briefed 
the issues. The Court will address each of the motions below. In accord with 
Magistrate Joseph's analyses, all motions will be denied. The Court will 
overrule Hutchins's objections and adopt Magistrate Joseph's 
recommendation in large measure. 

2. LEGAL STANDARD 

When reviewing a magistrate's recommendation, this Court is 
obliged to analyze de novo "those portions of the report or specified 
proposed findings or recommendations to which objection is made." 28 
U.S.C. § 636(b)(1)(C). The Court can "accept, reject, or modify, in whole or 
in part, the findings or recommendations made by the magistrate." Id. The 
Court's review encompasses both the magistrate's legal analysis and factual 
findings. Id.; see also Fed. R. Crim. P. 59(b). 

3. RELEVANT FACTS 

Hufchins, a cifizen of the United Kingdom, is a coder and hacker of 
considerable repute. He is most well-known for finding the kill-switch to a 
North Korean malware called WarmaCry in May 2017. According to the 
superseding indictment, several years ago, Hutchins developed two types 
of malware, UPAS Kif and Kronos (a "banking trojan"). 

The superseding indictment alleges that Hutchins developed UPAS 
Kit and, in 2012, sold it to Individual A, who then sold it to an individual in 
the Eastern District of Wisconsin. Af some point before July 2014, Hufchins 
allegedly developed Kronos and provided it to Individual A, intending for 
Individual A fo advertise, promote, and sell it. Hutchins used a YouTube 
video to demonstrate how Kronos worked, and referred prospective 
customers to Individual A. In December 2014, Hutchins hacked and 
analyzed a malware that competed with Kronos, and published a blog post 
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describing the competing malware's vulnerability. In February 2015, 
Hutchins allegedly updated the Kronos malware, and distributed it to 
Individual B, who was located in California and was known to be involved 
in cyber-based criminal activities. 

On July 11, 2017, a grand jury indicted Hutchins on various counts 
related to his activity with the malware. He was charged with conspiracy, 
fraud, and unlawfully intercepting communications. (Docket #1). On June 
5, 2018, the government filed a superseding indictment with additional 
charges. (Docket #86). In Count One, the superseding indictment charges 
Hutchins with conspiring to violate the Computer Fraud and Abuse Act 
("CFAA"), 18 U.S.C. § 1030, and the Electronic Communications Privacy 
Act ("Wiretap Act"), 18 U.S.C. § 2510 et seq., in violation of 18 U.S.C. § 371. 
Counts Two and Three charge Hutchins with disseminating, aiding, and 
abetting an attempt to advertise the malware, in violation of the Wiretap 
Act. Counts Four and Five charge Hutchins with aiding and abetting the 
distribution of the malware, in violation of the Wiretap Act. Count Six 
charges Hutchins with using, or getting others to use, the malware to 
intercept communications in violation of the Wiretap Act. Count Seven 
charges Hutchins with causing, aiding, and abetting the transmission of 
malware in violation of the CFAA. Count Eight charges Hutchins with 
aiding and abetting the intentional access and damage to protected 
computers for the purpose of privafe financial gain, in violation of the 
CFAA. Count Nine charges Hutchins with lying to the FBI about whether 
he knew that his computer code was part of Kronos, in violation of 18 U.S.C. 
§ 1001(a)(2). Finally, Count Ten charges Hutchins with conspiring to 
commit fraud in cormection with his malware activities, in violation of 18 
U.S.C. §§ 1343,1349. 
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In the summer of 2017, Hutchins spent a week in Las Vegas to attend 
"Defcon," which is a conference for hackers. On Augusf 2, 2017, Hufchins 
was about to embark on his journey back to the U.K. Hutchins was waiting 
in a lounge at the Las Vegas airport when a federal agent and two Customs 
and Border Patrol ("CBP") officials approached him. Unbeknownsf to him, 
FBI Special Agents Lee Chartier ("Chartier") and Jamie Butcher ("Butcher") 
had been monitoring Hutchins's whereabouts all morning, and had 
followed him to the airport, through security, and to his lounge. Although 
the FBI had originally planned to arrest Hutchins as he boarded the flight, 
they opted to arrest him earlier in order to ensure that he did not consume 
any alcoholic beverages that might affect his ability to answer questions in 
an interrogation. Indeed, Hutchins had spent much of the week partying, 
which included ingesting various intoxicating substances. He had had very 
little sleep the night before. There are no allegafions, however, thaf 
Hufchins was intoxicafed whilsf af the airport—only exhausted and, it can 
be assumed, terribly hungover. 

Thus, at approximately 1:17 p.m., Hutchins was approached in the 
airport lounge by two CBP officers and a plainclothes FBI agent, Chartier. 
These officials escorfed Hutchins to a stairwell, whereupon he was 
handcuffed. Chartier informed Hutchins that he was under arrest pursuant 
to a federal warrant. The officials then led Hutchins to an interview room, 
where Butcher was waiting. The agents observed Hutchins to be alert, 
engaged, and not visibly intoxicated or disoriented. Hutchins verbally 
confirmed thaf he was able to answer questions and was not drunk. 
Hutchins received his Miranda rights orally. He was also given an 
advisement of rights form. He listened to his rights and signed the 
advisement form in the presence of both agents. There is a dispute as to 
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what time he signed it, but the Court does not find this to be material for 
reasons that will be explained below. 

Hutchins then proceeded to respond to the questions asked by the 
agents, and gave consent for them to search his phones, laptops, backpacks, 
and USB drives. He did not request a lawyer or invoke his right to remain 
silent, although he did ask "what this is all about." The agents told him they 
would explain eventually, but continued questioning him. In total, 
Hutchins was questioned for approximately 105 minutes. He was offered 
food, an opportunity to use the restroom, and—eventually—allowed to 
contact his mother. He was not shown a copy of the arrest warrant until 
over an hour into the interrogation.^ 

Hutchins showed every indication of being voluntarily cooperative 
with the agents, but was also clearly confused about the nature of the 
interrogation. The interrogation began with broad questions about his 
career and his online activities, but about ten minutes in, the questions 
focused on Hutchins's involvement with malware. Hutchins acknowledged 
that when he was younger, he had written some code that ultimately ended 
up in malware, but denied that he developed malware. About eleven 
minutes into the interrogation, after looking at a string of code, Hufchins 
asked if they were looking for the developer of Kronos. Hutchins stated that 


^The Court notes that the agents' testimony is somewhat contradictory on 
this point. Chartier stated that they showed Hutchins the warrant before the 
interrogation was recorded. By contrast. Butcher stated that they first showed 
Hutchins the warrant over an hour into the interrogation. The recording of the 
interrogation suggests that Butcher is correct. Specifically, over an hour into the 
recording, Chartier says: "Okay. Well, here's the arrest warrant. And just to be 
honest—just to be honest, hey, now I'm going to tell you the truth...If I'm being 
honest with you, Marcus, this has absolutely nothing to do with WarmaCry." The 
balance of the evidence strongly suggests that Hutchins was not shown the arrest 
warrant until over an hour into the interrogation. 
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he did not develop Kronos, and he had "gotten out" of writing code for 
malware before he was eighteen. Thirteen minutes in, he said that he had 
feared that law enforcement authorities would come after him, instead of 
the actual developer, because pieces of his code appeared in Kronos. Thus, 
Hutchins was aware that the criminal investigation was, at least in part, 
about Kronos, and that he was implicated in the investigation, although he 
expressed confusion about why he was being detained throughout the 
interrogation. Almost eighty minutes into the recorded interrogation, the 
agents finally provided him with the warrant, and told him that it had 
"nothing to do with WarmaCry." The interrogation continued for abouf 
twenfy minutes after that. Throughout the remainder of the interrogation, 
Hutchins tried to be helpful buf nofed that he had been "out" of so-called 
"black hat" hacking for so long that he did not have any helpful 
cormecfions. 

Hufchins was faken fo a jail, where he proceeded fo make two phone 
calls, which were recorded. Prior to making the phone calls, Hutchins was 
informed that the phone calls were subject to monitoring and recording. In 
the calls, Hutchins also made incriminating statements. 

4. ANALYSIS 

4.1 Motion to Suppress 

Hutchins seeks to suppress his post-arrest statements and any 
evidence that may have been obtained as a result of his statements. He 
argues that he did not waive his Miranda rights, (Docket #55 at 6-9), and 
submits that the government has not met its burden in rebutting the 
presumption against waiver, (Docket #111 at 13). Hutchins calls into 
question whether (1) he received notice of his rights at all; and (2) whether 
he was able to voluntarily waive his rights due to his intoxication, his 
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limited understanding of the American criminal procedural system, and the 
deceptive nature of the interrogation. 

It is axiomatic that law enforcement officers must inform suspects of 
their Miranda rights before a custodial interrogation. United States v. 
Thurman, 889 F.3d 356,364 (7th Cir. 2018). "If the suspect invokes his rights, 
the officers must cease their questioning." Id. However, before officers must 
cease their questioning, the burden is on the suspect to assert his Miranda 
rights in a "clear and unambiguous" fashion. Id. (quoting United States v. 
Lee, 413 F.3d 622,625 (7th Cir. 2005)). Hutchins did not make any statements 
regarding his intent to invoke his Miranda rights; therefore, his rights were 
not invoked in a clear and unambiguous fashion. The interrogation 
properly proceeded. 

However, "[e]ven if a suspect does not invoke his Miranda rights, his 
self-incriminating statements cannot be used against him in court unless the 
Government shows by a preponderance of the evidence that he voluntarily 
waived these rights." Thurman, 889 F.3d at 364 (citing Berghuis v. Thompkins, 
560 U.S. 370, 382-84 (2010); United States v. Brown, 664 F.3d 1115, 1118 (7th 
Cir. 2011)). Indeed, the Court must "indulge in every reasonable 
presumption against waiver." Brewer v. Williams, 430 U.S. 387, 404 (1977). 
In order to rebut the presumption, the government must show that 
Hutchins's decision to give up his rights was "the product of a free and 
deliberate choice. . .made with a full awareness of both the nature of the 
right being abandoned and the consequences of the decision to abandon it." 
Berghuis, 560 U.S. at 382-83 (internal quotations and citations omitted). 

Voluntariness, or free and deliberate choice, is assessed in view of 
the totality of the circumstances. Brown, 664 F.3d at 1118. The Court will 
consider, among other things, a defendant's age, level of educafion, and 
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prior experience with law enforcement, as well as the conditions of the 
interrogation itself and the attitude of the interrogating officials. Thurman, 
889 F.3d at 364-65; Brown, 664 F.3d at 1118; United States v. Shabaz, 579 F.3d 
815, 820 (7th Cir. 2009). "The law can presume that an individual who, with 
a full understanding of his or her rights, acts in a manner inconsistent with 
their exercise has made a deliberate choice to relinquish the protection those 
rights afford." Berghuis, 560 U.S. at 385; Thurman, 889 F.3d at 364-65 (finding 
waiver despite refusal to sign a waiver form because the defendant 
understood his rights, the interrogation was "low key and informal," and 
defendant engaged in the interrogation); United States v. Smith, 218 F.3d 777, 
781 (7th Cir. 2000) (finding waiver despite refusal to sign waiver form 
where a suspect "immediately began talking to the agents...[and] never 
requested an attorney and never asked that the questioning be stopped."). 

4.1.1 Adequate Receipt of Miranda Rights 
Hutchins argues that there is insufficient evidence that he received 
notice of his Miranda rights. This argument is a non-starter, in part because 
Hutchins acknowledges that he was read his rights. (Docket #55 at 5-6) 
("[Tjhere seems to be little doubt that the agents—in some unspecified 
fashion, at an uncertain time—advised Mr. Hutchins of his rights under 
Miranda."). Hutchins makes much about the fact that there is no proof that 
he received his rights at the begirming of the interrogation, but he does not 
suggest when else they may have been given. Additionally, both agents 
have testified, under oath and in non-contradictory terms, that the rights 
were given at the begirming of the interrogation. Moreover, in the recorded 
portion of the interrogation. Butcher provided Hutchins with a consent 
form to search his computers and said, "because we're the government, 
there's a form for that, too," implying that Hutchins had previously 
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received other consent forms. The Court sees no reasonable basis to 
conclude that Hutchins did not receive notice of his rights before the 
interrogation. 

Additionally, it does not actually matter when Hutchins signed the 
advisement of rights form, so long as he was apprised of his Miranda rights 
prior to questioning. "[T]he rigidity of Miranda does not extend to the 
precise formulation of the warnings given a criminal defendant.. .[and] no 
talismanic incantation is required to satisfy its strictures." Duckworth v. 
Eagen, 492 U.S. 195,202-03 (1989) (quoting California v. Prysock, 453 U.S. 355, 
359 (1981)) (internal quotation marks omitted). Courts merely look to 
whether the law enforcement officers "fully conveyed" the rights. Prysock, 
453 U.S. at 361; In re Terrorist Bombing of U.S. Embassies in E. Africa, 552 F.3d 
177,209 (2d Cir. 2008) (oral warnings sufficient to satisfy Miranda regardless 
of any alleged deficiencies in the advisement of righfs form). In light of 
Hufchins's admission that he received his Miranda rights, and in light of the 
agents' corroborating testimony that this occurred before the interrogation, 
as well as the lack of any indication of when else he may have received 
them, the Court finds that Hutchins was sufficiently apprised of his rights 
before the interrogation. 

4.1.2 Voluntariness of Waiver 

The waiver of Hutchins's Miranda rights must have been "voluntary 
in the sense that it was the product of a free and deliberafe choice rather 
than intimidation, coercion, or deception." Moran v. Burbine, 475 U.S. 412, 
421 (1986). Hutchins must also have waived his rights with "a full 
awareness of both the nature of the right being abandoned and the 
consequences of the decision to abandon it." Id. Hutchins argues he did not 
voluntarily waive his Miranda rights because he was intoxicated, unsure 
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about American criminal procedure, and deceived by the questioning 
agents as to the nature of his arrest. These factors will be assessed in turn. 

4.1.2.1 Intoxication 

In assessing the validity of a Miranda waiver, courts may consider 
intoxication, lack of sleep, or other physical discomfort as they affect a 
defendant's susceptibility to coercion. See United States v. Brooks, 125 F.3d 
484, 491 (7th Cir. 1997) (finding voluntary waiver despite the fact that 
defendant was high on crack, sleep deprived, and in pain). However, 
"intoxication. . .by itself—without some showing of coercion by the 
government—will not negate voluntariness." United States v. Chrimson, 965 
F.2d 1465,1469 (7th Cir. 1992); Anderson v. Thieret, 903 F.2d 526, 530-31 (7th 
Cir. 1990) (noting that impairment is unlikely where approximately 19 
hours had elapsed between the defendant's last drink and his confession). 
Additionally, "mental state alone carmot make [a defendant's] confession 
involuntary. . .[I]t is relevant only to the extent it made him more 
susceptible to mentally coercive police tactics." Id. at 530 n.l (citing Colorado 
V. Connelly, 479 U.S. 157, 163-67 (1986)). 

It is unlikely that Hutchins's alleged impairment significantly 
factored into his ability to give a voluntary waiver or made him more 
susceptible to deceptive interrogation tactics. The agents monitored 
Hutchins from the begirming of the day to ensure that he was sober when 
he was arrested. They ensured that he was in custody before he had the 
opportunity to drink at the airport. They walked him to two separate 
locations (first, the stairwell; second, the interview room) and engaged him 
in conversation, which gave them opportunity to evaluate whether 
Hutchins appeared to be somehow impaired by an intoxicant. Hutchins 
appeared to be alert, engaged, coordinated, and coherent. There is no 
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evidence in the record to the contrary. There is also no evidence, nor does 
Hutchins claim, that he was under the influence of drugs that day—only 
that he was exhausted. But a terrible hangover alone does not, as a matter 
of law, render someone unable to exercise or waive their Miranda rights. 
This factor does not weigh in Hutchins's favor. 

4.1.2.2 Intelligent Waiver 

Hutchins next argues that he did not appreciate the nature of his 
Miranda rights, or the consequences of waiving them, because he was 
confused by the purpose of the interrogation, and believed, based on U.K. 
criminal procedure, that it would be helpful for him to speak in his defense. 
(Docket #111 at 13).^ 

The Court takes judicial notice of the warning given to suspects upon 
arrest in the U.K., which advises: "You do not have to say anything. But it 
may harm your defence if you do not mention when questioned something 
which you later rely on in Court. Anything you do say may be given in 
evidence." Police and Criminal Evidence Act 1984 Code G ^ 3.5, Revised 
Code of Practice for the Statutory Power of Arrest by Police Officers 
(revised July 2012), 

https://www. gov.uk/government/uploads/system/uploads/attachment_da 
ta/file/117583/pace-code-g-2012.pdf. For comparison, an arrest warning in 
the United States reads to the effect of, "you have the right to remain silent, 

^Hutchins also stresses that agents arrested him at the last possible 
moment, rather than on July 11, 2017, when the indictment came in, in order to 
confuse him. The logic underlying this argument is not entirely clear, and there 
are other obvious, less nefarious reasons why there might be a delay in the arrest 
{e.g., the desire to prolong the investigation throughout the conference; the arrest 
logistics). It is not eminently clear what is confusing about being arrested on the 
plane versus at any point earlier. 
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anything you say can and will be used against you in a court of law." See 
e.g., Miranda v. Arizona, 384 U.S. 436, 444 (1966). 

On its face, the U.K. warning appears to serve the same function as 
the U.S. warning, but there are important differences that theoretically 
would have affected whether Hutchins appreciated the consequence of 
giving up his right to remain silent. In the U.K., a defendant is told, "You 
do not have to say anything." There is neither right, nor waiver—the 
consequence stems, in fact, from not saying anything ("it may harm your 
defence if you do nof mention when questioned..."). By contrast, in the 
U.S., a defendant is told "you have a right to remain silent," and the 
consequences of failing to remain silent are clear: "anything you say can 
and will be used against you." The warnings—and their consequences—are 
substantively different, although their cadences are similar. It is conceivable 
that anyone—even a well-educated person—would find comfort in the 
broad similarities between the two, and believe that, wording aside, the 
substance is the same. 

The Seventh Circuit has held that Miranda waivers are valid so long 
as the defendant has a general understanding of the nature of the right, and 
the consequences of waiver. See Collins v. Gaetz, 612 F.3d 574, 588 (7th Cir. 
2010). In Gaetz, which evaluated a person of limited mental capacity's 
ability to waive his rights, the Court of Appeals referred to a "relatively low 
bar in proving an intelligent waiver," whereby a defendant need only 
comprehend the most basic concepts underlying Miranda. Id. Other circuits 
to consider this issue in the context of foreign cifizens have invalidafed a 
waiver only where the defendant's grasp on the interrogating language was 
so attenuated that he could not intelligently waive his rights. See United 
States V. Amano, 229 F.3d 801, 805 (9th Cir. 2000) (finding thaf a defendant's 
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lack of contact with the U.S. criminal justice system and the Japanese 
consulate "did not render his waiver involuntary" in light of evidence that 
he understood English, was read his rights twice, and claimed to 
understand them); c.f. United States v. Garihay, 143 F.3d 534, 538-39 (9th Cir. 
1998) (finding no valid waiver where the defendant was not fluent in 
English and had a low verbal IQ); United States v. Zaitar, 858 F. Supp. 2d 
103, 115-16 (D.D.C. 2012) (finding no valid waiver of counsel during an 
interview in Romania conducted in Portuguese by American officials, 
where the defendant, a native Lebanese speaker, responded affirmatively 
to all questions except the question regarding waiver of counsel, to which 
he replied, nonsensically, "I understand Portuguese."). 

Hutchins is a well-educated English-speaker from a common law 
country. Although there is no language barrier, he claims that he did not 
understand the consequences of waiving his Miranda rights in light of the 
subtle, but substantive, differences between U.S. and U.K. arrest procedure. 
The Court is inclined to agree that these differences, though small, are 
elemental enough that they may have affected Hutchins's understanding of 
the basic concepts underlying Miranda (i.e., whether it would be helpful for 
him to speak). However, in light of Hutchins's mental acuity, the Court 
carmot find that his waiver was unintelligent. This factor does not weigh 
heavily in his favor. 

4.1.2.3 Deception 

In order to establish that his statement was the product of deception, 
Hutchins bears the burden of showing by "clear and convincing evidence 
that that the agents affirmatively mislead him as to the true nature of their 
investigation." United States, v. Serlin, 707 F.2d 953, 956 (7th Cir. 1983). 
"Defendant must also prove that the misinformation was material in his 
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decision to speak with the agents." Id. "Simple failure to inform defendant 
that he was the subject of the investigation, or that the investigation was 
criminal in nature, does not amount to affirmative deceit unless defendant 
inquired about the nature of the investigation and the agents' failure to 
respond was intended to mislead." Id. The fact that an agent makes 
misrepresentations to a defendant, while relevant, is "insufficient. . .to 
make [an] otherwise voluntary confession inadmissible." Frazier v. Cupp, 
394 U.S. 731, 739 (1969); but see United States v. Giddins, 858 F.3d 870, 885 (4th 
Cir. 2017) (finding that a defendant's will was "overborne or his capacity 
for self-determination critically impaired" where he voluntarily went to the 
police station under the pretense of retrieving an impounded car, was 
repeatedly told that he was not under arrest or investigation, but was 
interrogated anyway). 

In Serlin, a defendant was questioned by the IRS regarding a criminal 
investigation, but did not realize that he was the target of the investigation. 
707 F.2d at 957. The agents initially told him they were investigating his 
business partners, but several minutes into the interview, warned the 
defendant not to make incriminating statements. Id. The defendant 
continued to speak. Id. The Seventh Circuit determined that the defendant's 
statements "were not the product of affirmative deceit," in large part 
because the statements that the agents made were true—the agents were, in 
fact, investigating the defendant's business partners as well. Id. Moreover, 
the agents warned the defendant not to incriminate himself, and then 
specifically asked about his own failure to file taxes. Id. On those facts, the 
Seventh Circuit determined that "even the most unsuspecting taxpayer 
[would be alerted that he] was, at least partly, the focus of the search." Id. 
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In this case, Hutchins received his Miranda rights and understood 
that he was under arrest for alleged criminal activity, and the investigation 
related, at least in some way, to Kronos. However, Hutchins's recent 
triumph with WarmaCry had vaulted him into the public eye as a "white 
hat" hacker. Thus, Hutchins could have been reasonably confused about 
the FBI's interest in him. In assessing whether he voluntarily waived his 
rights, some consideration must be given to the fact that white hat hacking 
is a complex and relatively novel field that can toe an already blurry line 
vis-a-vis online criminal activity. The agents did not tell Hutchins why he 
was under arrest, and did nothing to explain the nature of the charges 
against him until the end of his interrogation. Hutchins, who had no cause 
for concern regarding his role in WarmaCry, and who had distanced 
himself from nefarious internet activity, cooperated. The interrogation 
ended twenty minutes after he was presented with the warrant, though he 
continued to consent to searches and answer questions after he understood 
the charges against him. 

This case differs from Serlin in one salient way; Hutchins had already 
been indicted on a host of specific charges. Thus, the aim of the agents' 
questioning was not to cobble together enough information to establish 
probable cause for arrest, as it was in Serlin. Rather, the purpose of the 
interrogation was to continue collecting enough evidence to establish guilt 
beyond a reasonable doubt. The stakes were dramatically higher, and 
Hutchins's privilege against self-incrimination all the more precious. The 
government argues that this fact cuts against Hutchins—that is, he 
understood that the "nature" of the investigation was criminal, and should 
have known not to make incriminating statements. However, this ignores 
the context of Hutchins's work as a hacker. Hutchins had recently dealt 
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with matters of international concern, and reasonably believed that it was 
in his best interest to answer their questions. At one point in the 
interrogation, he made a comment that showed that he did not realize he 
had even been indicted. There is no reason why the government could not 
have told him exactly why he was arrested, as he requested, and as was 
required of them by Federal Rule of Criminal Procedure 4(c), unless they 
were concerned that he would not be cooperative with them. There is 
certainly an element of deception to this set of events that the Court does 
not endorse. 

On the other hand, the scope of the agents' questions should have 
put ITutchins on notice of the nature of the investigation. The agents did not 
try to "hide the ball," so to speak, about their interest in Kronos, and asked 
him about it early and often in the interrogation. And although the agents 
acted very familiarly with ITutchins, which may have put him at false ease, 
Chartier did remind him that he was in trouble. The Court is concerned by 
the abject failure of the agents to abide by the Federal Rules of Criminal 
Procedure 4(c), but their obvious interest in Kronos—including providing 
Fiutchins with a string of code related to Kronos—leads the Court to 
conclude that there is not clear and convincing evidence that they acted 
with intent to deceive. Moreover, the fact that Fiutchins continued to 
answer questions and consented to the search after he knew the substance 
of the indictment indicates that the deception was not material to his 
statements—that is, it seems that he would have attempted to be helpful 
even if he had seen the warrant.'^ 

^Hutchins does not argue the effect of the violation of Federal Rule of 
Criminal Procedure 4(c)(3)(A), which governs execution of a warrant: 
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4.1.2.4 Totality of the Circumstances 

Under the totality of the circumstances—considering Hutchins's 
exhausted state, his unfamiliarity with the American criminal procedure 
system, his high level of intelligence, and the lack of material deception, 
there is an insufficient basis for the Court to find that Hutchins's statements 
were involuntary. It is wholly improper that he was not provided with a 
warrant immediately upon arrest. But in light of the record of the post¬ 
arrest interrogation, the government has met its burden in proving that the 
waiver was voluntary. Thurman, 889 F.3d at 364. 

4.2 Motion to Dismiss 

Hutchins advances several motions to dismiss, all of which must be 
denied for the reasons given below. A motion to dismiss is proper where 
an indictment fails to state an offense. Fed. R. Crim. P. 12(b)(3)(B)(v). The 
indictment must contain a "plain, concise, and definite written statement of 


Upon arrest, an officer possessing the original or a duplicate 
original warrant must show it to the defendant. If the officer does 
not possess the warrant, the officer must inform the defendant of 
the warrant's existence and of the offense charged and, at the 
defendant's request, must show the original or a duplicate original 
warrant to the defendant as soon as possible. 

Few courts have had moment to consider whether a violation of this rule 
would warrant exclusion of evidence, though it certainly might, for deterrent 
purposes, if the violation compromised a substantive constitutional right and the 
officers acted bad faith. Bryson v. United States, 419 F.2d 695, 701-02 (D.C. Cir. 
1969); Murray v. United States, 855 P.2d 350, 353-56 (Wyo. 1993); United States v. 
Hamilton, 2017 WL 9476881, at *5 (N.D. Ga. Jan. 3, 2017). However, Hutchins did 
not raise this issue, so the Court will not consider it. Additionally, even if his 
statements were excluded, it is likely that the physical evidence still would be 
admissible. See United States v. Patane, 542 U.S. 630, 637-38 (2004) (failure to give 
Miranda warnings requires suppression of voluntary statements, but does not 
require suppression of physical evidence acquired as a result of those voluntary 
statements). 
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the essential facts constituting the offense charged." Fed. R. Crim. P. 7(c)(1). 
An indictment meets this rule's criteria if it "(1) states all the elements of the 
crime charged; (2) adequately informs the defendant of the nature of the 
charges so that he may prepare a defense; and (3) allows the defendant to 
plead the judgment as a bar to any future prosecutions." United States v. 
White, 610 F.3d 956, 958 (7th Cir. 2010). A charge that traces the language 
of the statute will typically suffice if it contains enough facts to provide the 
defendant with an understanding of the conduct at issue. United States v. 
Vaughn, 722 F.3d 918, 925 (7th Cir. 2013). "[T]he presence or absence of any 
particular fact is not dispositive." Id. (quoting White, 610 F. 3d at 958-59). 
"A motion to dismiss is not intended to be a 'summary trial of the 
evidence.'" United States v. Yasak, 884 F.2d 996,1001 (7th Cir. 1989) (quoting 
United States v. Winer, 323 F. Supp. 604, 605 (E.D. Pa. 1971)). The Court will 
not assess "the strength or weakness of the government's case" at this 
stage—rather, it will consider whether the government is theoretically able 
to prove its case. White, 610 F.3d at 958; United States v. Castor, 558 F.2d 379, 
384-85 (7th Cir. 1997). 

As Magistrate Joseph noted, the superseding indictment is facially 
sufficient because each charge in it lists the date of the alleged wrongful 
conduct, the elements of the crime charged, and the nature of the offense 
charged—including the software at issue—such that Hutchins would be 
protected from double jeopardy. See (Docket #109 at 20). The Court also 
agrees with Magistrate Joseph's analysis of United States v. Risk, 843 F.2d 
1059 (7th Cir. 1988), wherein the Seventh Circuit dismissed an indictment 
where the government provided a set of undisputed facts that did not 
constitute a violation of any statute. In Risk, the issue was not that the 
government failed to allege enough facts—it was that the facts the 
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government itself alleged could not, as a matter of law, result in a violation 
of a sfatufe. Id. af 1061. By contrasf, here, the government has alleged that 
Hutchins engaged in behavior that violated various statutes, and the 
government has not provided a set of undisputed facts to the contrary. 

Accordingly, the Court agrees with Magistrate Joseph's 
determination that the superseding indictment is sufficient. In the interest 
of thoroughness, Hutchins's specific argumenfs will be addressed below. 

4.2.1 Counts One and Seven Allege "Damage" Under 18 
U.S.C. § 1030 

Counts One and Seven are brought under the CFAA and allege that 

Hutchins conspired and attempted to cause damage to protected 

computers. Specifically, Counf One alleges thaf befween "July 2012 and 

September 2015, in the state and Eastern District of Wisconsin," Hutchins 

"knowingly conspired and agreed with Individual A ... to: 

(a) knowingly cause and aid and abet the transmission of a 
program, information, code, and command, and as a result of 
such conduct, intentionally cause damage without 
authorization, to 10 or more protected computers during a 1- 
year period, in violation of Title 18, United States Code, 
Sections 1030(a)(5)(A), (c)(4)(B)(i) and (c)(4)(A)(i)(VI) and 2." 
(Docket #86 at 3) (emphasis added). 

Belatedly, Count Seven alleges that: 

"On or about June 11, 2015, in the state and Eastern District of 
Wisconsin and elsewhere, MARCUS HUTCHINS, aka 
'Malwaretech,' aka 'irp@jabber.se,' knowingly caused and 
aided and abetted the transmission of a program, 
information, code and command and as a result of such 
conducf, attempted to cause damage without authorization, 
to 10 or more protected computers during a 1-year period. In 
violation of Title 18, United States Code, Sections 
1030(a)(5)(A), (c)(4)(B)(i) and (ii), (c)(4)(A)(i)(VI), 1030(b), and 
2." (Docket #86 at 12) (emphasis added). 
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Each count is facially sufficient because it traces the language of the 
statute, cites to the statute, and provides a date (and a location) for the 
alleged conduct. Vaughn, 722 F.3d at 925. Count One contains additional 
allegations, including that Hutchins developed UPAS Kit and provided it 
to Individual A, who sold it to an individual in the Eastern District of 
Wisconsin. (Docket #86 at 4). The count goes on to allege that Hutchins 
developed Kronos intending for Individual A fo advertise, promote, and 
sell it; used a YouTube video to demonstrate how Kronos worked; updated 
the Kronos malware; and evaluated competing malwares. Id. at 4-5. Finally, 
it alleges that Hutchins referred prospecfive cusfomers fo Individual A. Id. 
at 6. 

Hutchins argues that the facts as alleged are insufficient to state an 
offense. He submits that Counts One and Seven "fail[] to allege any facts 
that would show that Mr. Hutchins had any intent to cause 'damage' to a 
protected computer" because the superseding indictment does not allege 
that the malware at issue "damage[s]" computers. (Docket #95 at 1 and #111 
at 28). The CFAA defines damage as "any impairmenf fo the integrity or 
availability of data, a program, a system, or information." 18 U.S.C. § 
1030(e)(8). The superseding indictment states that UPAS Kit is a "malware" 
that allows for "unauthorized exfiltration," and Kronos is a "malware" that 
"recorded and exfiltrated" various data. (Docket #86 at 2). Hutchins 
suggests that "exfiltrate" means "making a copy of the data and taking it 
away," (Docket #95 at 5), which is not "damage" under the CFAA. 

The Seventh Circuit has held that "damage encompasses clearly 
destructive behavior such as using a virus or worm or deleting data.. .[b]ut 
it may also include less obviously invasive conduct, such as flooding an 
email accounf." Fidlar Tech. v. LPS Real Estate Data Solutions, Inc., 810 F.3d 
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1075, 1084-85 (7th Cir. 2016) (quotations omitted) (finding that a claim 
involving a web-harvester was "trespassory in nature" but "mere access" 
did not amount to damage under the CFAA). The word "exfiltrate" has 
several definitions, one of which is: "to steal (sensitive data) from a 
computer (as with a flash drive)." Exfiltrate, Merriam-Webster Dictionary 
Online, https://www.merriam-webster.com/dictionary/exfiltrate (accessed 
Jan. 19, 2019). When a person "steals (sensitive data)," as a matter of logic, 
they "impair[]. . .the integrity. . .of [the] data [or]. . .system." 18 U.S.C. § 
1030(e)(8). This is more than merely accessing data. Cf Landmark Credit 
Union v. Doberstein, 746 F. Supp. 2d 990, 993-94 (E.D. Wis. 2010) (finding no 
damage where former employee accessed and disclosed client list by 
emailing it to herself). The superseding indictmenf also describes the 
software at issue as "malware" or "malicious computer code intended to 
damage a computer." (Docket #86 at 2). These terms are sufficient to allege 
intent to cause damage. The burden will be on the government to prove this 
at trial. 

4.2.2 Counts One Through Six Refer to a "Device" Under 
18 U.S.C. § 2510(5) 

Counts One through Six are brought under the Wiretap Act, which 
criminalizes activity involving "any device or apparatus which can be used 
to intercept a wire, oral, or electronic communication." 18 U.S.C. § 2510(5). 
Hutchins argues that software such as Kronos and UPAS Kit should not be 
considered "devices" for the purposes of the Wiretap Act because software 
is not an "electronic, mechanical, or other device" under Section 2510(5). 
Hutchins relies on United States v. Szymuszkiewicz, in which the Court of 
Appeals assumed that "devices" referred to computers and servers that 
carried out a program, rather than the program itself. 622 F.3d 701, 707 (7th 
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Cir. 2010) (discussing a Microsoft Outlook "rule" for email forwarding). In 
Szymuszkiewicz, the Court of Appeals considered whether "the 'device' 
used to intercept a communication must differ from the device the intended 
audience uses to receive the message/' and determined that it did not. Id. 
The opinion did not consider whether a program or a piece of software 
could be considered a "device." Hutchins also relies on Potter v. Havlicek for 
the proposition that a software "alone carmot be used to intercept 
communications. It must be installed in a device, such as a computer, to be 
able to do so." 2008 U.S. Dist. LEXIS 122211, at =^23-24 (S.D. Ohio June 23, 
2008). The Havlicek court did not cite any cases directly in support of its 
conclusion, and this Court finds its definitional logic faulty: computers, 
alone, also carmot be used to intercept communications. They require some 
software or program installed in order to have this capability. 

The majority of courts to consider this issue have entertained the 
notion that software may be considered a device for the purposes of the 
Wiretap Act. See Luis v. Zang, 833 F.3d 619, 630 (6th Cir. 2016) (accepting 
that a software could be a "device" for the purpose of the Wiretap Act); In 
re Carrier IQ, Inc., 78 F. Supp. 3d 1051,1087 (N.D. Cal. 2015) (concluding that 
a software was an "electronic, mechanical or other device"); Klumb v. Goan, 
884 F. Supp. 2d 644, 661-62 (E.D. Ten. 2012) (analyzing spyware software 
as a device under Wiretap Act); Rene v. G.F. Fishers, Inc., 817 F. Supp. 2d 
1090, 1094 (S.D. Ind. 2011) (holding that keystrokes are not electronic 
communications for the purpose of the Wiretap Act, but accepting the 
notion that software could be a device); Shefts v. Petrakis, 2012 WL 4049484, 
at *8-9 (C.D. Ill. 2012) (analyzing software as a device under the Wiretap 
Act); see also United States v. Barrington, 648 F.3d 1178, 1203 (11th Cir. 2011) 
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(accepting that a keylogger software could be considered a scanning 
receiver, or a device, under 18 U.S.C. § 1029(e)(8)). 

The Court is in accord with the majority of courts to consider this 
issue. The Court also agrees with the governmenfs position that Section 
2510(5)'s reference to "mechanism," which is commonly defined as a 
"process, technique, or system for achieving a result" seems to encompass 
software. Mechanism, Merriam-Webster Dictionary, https://www.merriam- 
webster.com/dictionary/mechanism (accessed Jan. 22, 2019); see also United 
States V. Mitra, 405 F.3d 492,495 (7th Cir. 2005) (acknowledging that general 
technology statute should be read broadly in order to accommodate new 
developments). 

4.2.3 Counts One, Four Through Eight, and Ten Allege 
Intent and Causation 

Hutchins argues that the superseding indictment does not allege the 
necessary intent and causation elements in Counts One, Four through 
Eight, and Ten. The aforementioned counts each contain an intent element 
in connection with allegedly distributing malware for illegal purposes. 
Hutchins argues that the superseding indictment fails to specifically allege 
that he "intended any specific result to occur" as a result of his activities, 
and therefore, the superseding indictment does not state offenses. (Docket 
#95 at 12). 

These are arguments that go to the merits of the case, i.e., whether 
Hutchins had the requisite intent to commit the crimes charged. As 
discussed above, the superseding indictment is facially valid, and Hutchins 
does not contend that these specific counts lack all elements of the crimes 
charged, fail to inform him of the nature of the offenses, or are so 
insufficiently pled that he would be prevented from asserting any judgment 
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as a bar to future prosecutions of the same offense. Vaughn, 722 F.3d at 925. 
The superseding indictment does not need to establish intent—it merely 
needs to allege it, which it does by listing the elements of the crimes 
charged. As the magistrate noted, Hutchins "tries to impose a standard for 
civil pleading on a criminal indictment." (Docket #109 at 26). Therefore, this 
motion to dismiss will be denied. 

4.2.4 Counts Two and Three are not Multiplicitous 
Hutchins contends that Counts Two and Three are multiplicitous 
and submits that Count Three should be dismissed. (Docket #95 at 9-11). 
Count Two charges Hutchins with a violation of 18 U.S.C. § 2512(l)(c)(i), 
Count Three charges Hutchins with a violation of 18 U.S.C § 2512(l)(c)(ii). 
"If one element is required to prove the offense in one count which is not 
required to prove the offense in the second count, there is no multiplicity." 
United States v. Conley, 291 F.3d 464, 470 (7th Cir. 2002) (citing United States 
V. Briscoe, 896 F.2d 1476, 1522 (7th Cir. 1990) (quoting United States v. 
Marquardt, 786 F.2d 771, 778 (7th Cir. 1986)) (internal citations and 
quotations omitted)). Put another way, the Court must determine whether 
each count requires proof of a fact that the other does not. 

The relevant portions of the statute make it unlawful for a person to 
intentionally: 

"(c) place [] in any newspaper, magazine, handbill, or other 
publication or disseminate[] by electronic means any advertisement 
of— 

(i) any electronic, mechanical, or other device knowing or 
having reason to know that the design of such device renders 
it primarily useful for the purpose of the surreptitious 
interception of wire, oral, or electronic communications; or 
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(ii) any other electronic, mechanical, or other device, where 
such advertisement promotes the use of such device for the 
purpose of the surreptitious interception of wire, oral, or 
electronic communications." 18 U.S.C. § 2512(l)(c)(i),(ii). 

In other words. Count Two, Section 2512(l)(c)(i), requires that 

Hutchins (1) made an advertisement with (2) knowledge or reason to know 

that the device's primary design was for surreptitiously infiltrating 

communication. There is no element requiring that Hutchins promoted the 

device as one that could be used for the surreptitious interception of 

communication, only that he knew its primary design was that. 

By contrast. Count Three, Section 2512(l)(c)(ii), requires that 

Hutchins (1) made an advertisement with (2) the claim or promotion that a 

device could be used for the surreptitious interception of communication. 

Count Three does not require that Hutchins knew or had reason to know 

that its primary design was surreptitious interception of communication, as 

Count Two requires, only that he promoted it for that purpose. 

Each count contains an element required to prove the offense that is 

not required in the other count, and the counts require proof of different 

facts. There is no multiplicity. 

4.2.5 Count Seven does not Contain a Grand Jury Defect 

As discussed above. Count Seven alleges violations of the CFAA, 
which criminalizes actions intended to damage protected computers. 18 
U.S.C. § 1030(a)(5)(A) applies to one who "intentionally causes damage 
without authorization." Count Seven charges Hutchins with "attempt[ing] 
to cause damage without authorization." (Docket #86 at 12). To prove an 
attempt to violate Section 1030(a)(5)(A), the government must prove that 
(1) Hutchins knowingly took a substantial step toward committing a 
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violation of Section 1030(a)(5)(A) and (2) that he did so with the intent to 
violate § 1030(a)(5)(A). Seventh Circuit Pattern Jury Instruction 4.09 (2012) 
(emphasis added). It is fairly well settled that allegations of "attempt" 
necessarily encompasses the intent element. United States v. Resendiz-Ponce, 
549 U.S. 102, 107 (2007) (holding that "the word 'attempt' as used in 
common parlance cormote[s] action rather than mere intent, but more 
importantly, as used in the law for centuries, it encompasses both the overt 
act and intent elements.") (emphasis added). The indictment must "set forth 
all the elements necessary to constitute the offense infended fo be 
punished" and allow defendanf to "pin[] down the specific conducf af 
issue." Smith, 230 F.3d at 305 (internal citations omitted). However, the 
absence of any particular fact is not necessarily dispositive, and indictments 
are reviewed "on a practical basis and in their entirety, rather than in a 
hypertechnical maimer." Id. (quotations and citations omitted); see also 
(Docket #109 at 29). 

Hutchins argues that he caimot be charged with attempt to aid and 
abet an attempt to violate the CFAA because Count Seven is pled "without 
reference to the intentional causing of damage," as stated in the statute. 
(Docket #92 at 5). The superseding indictment alleges that Hutchins 
attempted to cause damage, which encompasses the intent element. 
Whether the government can actually prove this at trial is a question for 
another time. 

4.2.6 Extraterritorial Challenges 

Hutchins argues that Counts Two and Three, which arise under the 
Wiretap Act, are an improper exercise of extraterritorialify because they do 
not charge domestic conduct. (Docket #96 at 6). He further argues that 
Congress did not intend for the Wiretap Act, 18 U.S.C. § 1343, or 18 U.S.C. 
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§ 1001 to have extraterritorial application, "so the government must allege 
domestic violations of those statutes to state viable claims." Id. at 8. 

The Court generally agrees with the magistrate's finding that the 
superseding indictment alleges domestic violations of all statutes, and 
therefore there is no extraterritoriality issue at hand. For example, the 
superseding indictment alleges that the criminal conduct in question 
occurred in the Eastern District of Wisconsin. (Docket #86). Specifically, it 
alleges that Hutchins developed UPAS Kit and provided it to Individual A, 
who subsequently sold it to someone in the Eastern District of Wisconsin. 
Id. at 4. The superseding indictment further alleges that Hutchins 
developed Kronos and provided it to Individuals A and B, the former of 
whom advertised, marketed, and sold Kronos in the Eastern District of 
Wisconsin. Id. at 4-6. It also alleges that Hutchens used a YouTube video to 
promote the sale of Kronos, and referred interested purchasers of Kronos 
to Individual A. Id. at 4, 6. As Magistrate Joseph and this Court have 
repeatedly stated, "whether the government will be able to prove that is a 
question for another day." (Docket #109 at 31). However, as stated, the 
charges sufficiently allege activity in the United States, specifically in the 
Eastern District of Wisconsin. There is no extraterritorial activity at issue. 

However, because there is confusion about the proper standard to 
apply in the extraterritorial analysis, the Court takes this opportunity to 
clarify the issue in case it should arise in the future. There is a presumption 
against applying statutes extraterritorially because "Congress generally 
legislates with domestic concerns in mind." Small v. United States, 544 U.S. 
385, 388 (2005) (quotations and citations omitted). This broad presumption 
applies in all cases, "preserving a stable background against which 
Congress can legislate with predictable effects." Morrison v. Nat'l Australian 
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Bank Ltd., 561 U.S. 247,261 (2010). "[G]eneral reference to foreign commerce 
in the definition of 'interstate commerce' does not defeat the presumption 
against extraterritoriality." Id. at 263. Although Congress does not need to 
explicitly state a rule of extraterritoriality and "context can be consulted/' 
there must be an "affirmative indication" of Congress's extraterritorial 
intent. Id. at 265. 

Thus, the first step in any inquiry—civil or criminal—is "whether the 
presumption against extraterritoriality has been rebutted—that is, whether 
the statute gives a clear, affirmative indication that it applies 
extraterritorially." RJR Nabisco, Inc. v. European Cmty., 136 S. Ct. 2090, 2101 
(2016) (discussing RICO statute's extraterritorial hold). If there is no clear, 
affirmative indication of extraferriforial application, courts are instructed to 
consider 

whether the case involves a domestic application of the 
statute. . .by looking to the statute's focus. If the conduct 
relevant to the statute's focus occurred in the United States, 
then the case involves a permissible domestic application 
even if other conduct occurred abroad; but if the conduct 
relevant to the focus occurred in a foreign counfry, then the 
case involves an impermissible extraterritorial application 
regardless of any other conduct that occurred in U.S. territory. 

Id. (quotation marks omitted). 

In other words, if there is no clear Congressional intent for 
exfraterriforialify, the Court must determine (1) the statute's focus and (2) 
whether the conduct relevant to the focus occurred in the United States. Id. 

The government and the magistrate rely on United States v. Bowman, 
260 U.S. 94,98-99 (1922) and United States v. Leija-Sanchez, 602 F.3d 797, 799 
(7th Cir. 2010) {“Leija-Sanchez 7") to stand for the broad proposition that the 
presumption against extraterritoriality does not apply to criminal cases. In 
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light of Morrison and RJR Nabisco, this is not the correct standard. However, 
neither case has been overruled—and, indeed, there is no conflict with their 
holdings. 

In Bowman, the Supreme Court held that a criminal fraud statute 
applied to certain extraterritorial conduct at sea and in foreign porfs affer 
finding that Congress must have intended it to apply to at-sea vessels and 
foreign porfs. 260 U.S. af 102. Although the statute did not explicitly say 
that it applied extraterritorially, the Supreme Court determined that 
Congress's intent for exfraterritorial application could be inferred from the 
function of the statute and from other sections in the statute's chapter, 
which was titled, "Offenses against the Operation of Government." Id. at 
98-99; see also; RJR Nabisco, 136 S. Ct. at 2102 ("an express statement of 
extraterritorialify is not essential."). Thus, the Bowman opinion shows the 
Supreme Court's determination that there was a "clear, affirmative 
indication" that the statute applied extraterritorially. See Morrison, 561 U.S. 
at 265; RJR Nabisco, 136 S. Ct. at 2101. 

In 2016, the Seventh Circuit upheld its decision in Leija-Sanchez I, 
which found that a criminal RICO statute applied extraterritorially to 
individuals who murdered a Mexican man in Mexico. United States v. Leija- 
Sanchez II, 820 F.3d 899, 900 (7th Cir. 2016) (Leija-Sanchez II). Ten days after 
the Seventh Circuit denied rehearing in Leija-Sanchez II, the Supreme Court 
issued RJR Nabisco, which noted that "[t]he unique structure makes RICO 
the rare statute that clearly evidences extraterritorial effect despite lacking 
an express statement of extraterritoriality." RJR Nabisco, 136 S. Ct. at 2103. 
In the Leija-Sanchez cases, the murder was arranged and paid for in the 
United States in order to protect a criminal organization based in the United 
States, whose focus was defrauding the United States government. See Leija- 
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Sanchez II, 820 F.3d at 901. The Court will not take it upon itself to re-write 
the Seventh Circuit's analysis in light of RJR Nabisco, buf merely observes 
that it is possible to reconcile Leija-Sanchez I&cII with the rule in RJR Nabisco. 

Therefore, the proper rule to apply is that of RJR Nabisco: if Congress 
has nof evinced an affirmative infenf fo apply fhe sfatufe exfraferriforially, 
the Court must assess the focus of the statute, and determine whether the 
conduct relevant to the focus occurred in the United States. Under RJR 
Nabisco, some conduct could occur outside of the United States as long as 
the conduct relevant to the focus of the statute occurred inside the United 
States. However, as stated above, the conduct that the superseding 
indictment alleges took place in the United States. Therefore, the Court 
need not evaluate Sections 2512, 1343, or 1001 for exfraferritorial 
application. 

4.2.7 Counts One Through Eight and Ten do not Violate 
Due Process 

Hutchins argues that there is an insufficient nexus between his 
conduct and the United States, which violates his Due Process rights. 
Generally, a defendant must have adequate contacts with the United States 
in order to support United States jurisdiction. See In re Hijazi, 589 F.3d 401, 
412 (7th Cir. 2009); Restatement (Third) of Foreign Relations Law §§ 402, 
403 (1987); see also United States v. Yousef, 750 F.3d 254, 262 (2d Cir. 2014) 
("The due process requirement that a territorial nexus underlie the 
extraterritorial application of a criminal statute. . . protects criminal 
defendants from prosecutions that are arbitrary or fundamentally unfair.") 
(citations and quotations omitted). 

As the magistrate noted, the government's superseding indictment 
states the approximate date and location for each charge, and briefly 
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describes the allegedly unlawful conduct that occurred in the United States. 
To the extent that the government prosecutes Hutchins's activities within 
the United States—specifically, the Eastern District of Wisconsin—the 
Court finds that there is adequate nexus as alleged in the superseding 
indictment. For example, if, as if is alleged, Hutchins promoted his malware 
to individuals in the Eastern District of Wisconsin, then he could reasonably 
foresee being haled before fhis Court for trial on that issue. See United States 
V. Perlaza, 439 F.3d 1149, 1168 (9th Cir. 2006) ("The nexus requirement is a 
judicial gloss applied to ensure that a defendant is not improperly haled 
before a court for trial.") (citations and quotations omitted). Whether 
Hutchins actually did any of the alleged conduct is a question for the jury. 

4.2.8 The Superseding Indictment Properly Alleges Count 
Nine 

Count Nine charges Hutchins with lying to the FBI in violation of 18 
U.S.C. § 1001(a)(2). (Dockef #86 af 14). The crux of Hufchins's argumenf here 
is that Count Nine should be dismissed if Counts One through Eight and 
Ten are dismissed, because the FBI "had no power to exercise authority 
against Mr. Hutchins." (Docket #105 at 17) (citations and quotations 
omitted). Because none of the charges above are dismissed, the Court finds 
thaf the FBI was properly within its jurisdiction to investigate these claims. 
Therefore, the charge that Hutchins lied to the FBI must also go forward. 

5. Conclusion 

The Court lacks a sufficient basis to grant the motion to suppress or 
the motions to dismiss. Indeed, many of Hufchins's confenfions are nof 
properly resolved at the motion to dismiss stage. Therefore, the Court 
adopts the magistrate's recommendation to deny all motions. 
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Accordingly, 

IT IS ORDERED that Marcus Hutchins's motion to suppress 
(Docket #55) be and the same is hereby DENIED; 

IT IS FURTHER ORDERED that Marcus Hutchins's motion to 
dismiss (Docket #56) be and the same is hereby DENIED as moot; 

IT IS FURTHER ORDERED that Marcus Hutchins's motions to 
dismiss (Docket #92, #95, and #96) be and the same are hereby DENIED; 

IT IS FURTHER ORDERED that Marcus Hutchins's objections to 
Magistrate Judge Nancy Joseph's Report and Recommendation (Docket 
#111) be and the same are hereby OVERRULED in accordance with the 
terms of this Order; and 

IT IS FURTHER ORDERED that Magistrate Judge Nancy Joseph's 
Report and Recommendation (Docket #109) be and the same is hereby 
ADOPTED in accordance with the terms of this Order. 

Dated at Milwaukee, Wisconsin, this 11th day of February, 2019. 
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